• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 // SPDX-License-Identifier: GPL-2.0-only
2 #include <linux/mm.h>
3 #include <linux/slab.h>
4 #include <linux/string.h>
5 #include <linux/compiler.h>
6 #include <linux/export.h>
7 #include <linux/err.h>
8 #include <linux/sched.h>
9 #include <linux/sched/mm.h>
10 #include <linux/sched/signal.h>
11 #include <linux/sched/task_stack.h>
12 #include <linux/security.h>
13 #include <linux/swap.h>
14 #include <linux/swapops.h>
15 #include <linux/mman.h>
16 #include <linux/hugetlb.h>
17 #include <linux/vmalloc.h>
18 #include <linux/userfaultfd_k.h>
19 #include <linux/elf.h>
20 #include <linux/elf-randomize.h>
21 #include <linux/personality.h>
22 #include <linux/random.h>
23 #include <linux/processor.h>
24 #include <linux/sizes.h>
25 #include <linux/compat.h>
26 
27 #include <linux/uaccess.h>
28 
29 #include "internal.h"
30 
31 /**
32  * kfree_const - conditionally free memory
33  * @x: pointer to the memory
34  *
35  * Function calls kfree only if @x is not in .rodata section.
36  */
kfree_const(const void * x)37 void kfree_const(const void *x)
38 {
39 	if (!is_kernel_rodata((unsigned long)x))
40 		kfree(x);
41 }
42 EXPORT_SYMBOL(kfree_const);
43 
44 /**
45  * kstrdup - allocate space for and copy an existing string
46  * @s: the string to duplicate
47  * @gfp: the GFP mask used in the kmalloc() call when allocating memory
48  *
49  * Return: newly allocated copy of @s or %NULL in case of error
50  */
kstrdup(const char * s,gfp_t gfp)51 char *kstrdup(const char *s, gfp_t gfp)
52 {
53 	size_t len;
54 	char *buf;
55 
56 	if (!s)
57 		return NULL;
58 
59 	len = strlen(s) + 1;
60 	buf = kmalloc_track_caller(len, gfp);
61 	if (buf)
62 		memcpy(buf, s, len);
63 	return buf;
64 }
65 EXPORT_SYMBOL(kstrdup);
66 
67 /**
68  * kstrdup_const - conditionally duplicate an existing const string
69  * @s: the string to duplicate
70  * @gfp: the GFP mask used in the kmalloc() call when allocating memory
71  *
72  * Note: Strings allocated by kstrdup_const should be freed by kfree_const and
73  * must not be passed to krealloc().
74  *
75  * Return: source string if it is in .rodata section otherwise
76  * fallback to kstrdup.
77  */
kstrdup_const(const char * s,gfp_t gfp)78 const char *kstrdup_const(const char *s, gfp_t gfp)
79 {
80 	if (is_kernel_rodata((unsigned long)s))
81 		return s;
82 
83 	return kstrdup(s, gfp);
84 }
85 EXPORT_SYMBOL(kstrdup_const);
86 
87 /**
88  * kstrndup - allocate space for and copy an existing string
89  * @s: the string to duplicate
90  * @max: read at most @max chars from @s
91  * @gfp: the GFP mask used in the kmalloc() call when allocating memory
92  *
93  * Note: Use kmemdup_nul() instead if the size is known exactly.
94  *
95  * Return: newly allocated copy of @s or %NULL in case of error
96  */
kstrndup(const char * s,size_t max,gfp_t gfp)97 char *kstrndup(const char *s, size_t max, gfp_t gfp)
98 {
99 	size_t len;
100 	char *buf;
101 
102 	if (!s)
103 		return NULL;
104 
105 	len = strnlen(s, max);
106 	buf = kmalloc_track_caller(len+1, gfp);
107 	if (buf) {
108 		memcpy(buf, s, len);
109 		buf[len] = '\0';
110 	}
111 	return buf;
112 }
113 EXPORT_SYMBOL(kstrndup);
114 
115 /**
116  * kmemdup - duplicate region of memory
117  *
118  * @src: memory region to duplicate
119  * @len: memory region length
120  * @gfp: GFP mask to use
121  *
122  * Return: newly allocated copy of @src or %NULL in case of error
123  */
kmemdup(const void * src,size_t len,gfp_t gfp)124 void *kmemdup(const void *src, size_t len, gfp_t gfp)
125 {
126 	void *p;
127 
128 	p = kmalloc_track_caller(len, gfp);
129 	if (p)
130 		memcpy(p, src, len);
131 	return p;
132 }
133 EXPORT_SYMBOL(kmemdup);
134 
135 /**
136  * kmemdup_nul - Create a NUL-terminated string from unterminated data
137  * @s: The data to stringify
138  * @len: The size of the data
139  * @gfp: the GFP mask used in the kmalloc() call when allocating memory
140  *
141  * Return: newly allocated copy of @s with NUL-termination or %NULL in
142  * case of error
143  */
kmemdup_nul(const char * s,size_t len,gfp_t gfp)144 char *kmemdup_nul(const char *s, size_t len, gfp_t gfp)
145 {
146 	char *buf;
147 
148 	if (!s)
149 		return NULL;
150 
151 	buf = kmalloc_track_caller(len + 1, gfp);
152 	if (buf) {
153 		memcpy(buf, s, len);
154 		buf[len] = '\0';
155 	}
156 	return buf;
157 }
158 EXPORT_SYMBOL(kmemdup_nul);
159 
160 /**
161  * memdup_user - duplicate memory region from user space
162  *
163  * @src: source address in user space
164  * @len: number of bytes to copy
165  *
166  * Return: an ERR_PTR() on failure.  Result is physically
167  * contiguous, to be freed by kfree().
168  */
memdup_user(const void __user * src,size_t len)169 void *memdup_user(const void __user *src, size_t len)
170 {
171 	void *p;
172 
173 	p = kmalloc_track_caller(len, GFP_USER | __GFP_NOWARN);
174 	if (!p)
175 		return ERR_PTR(-ENOMEM);
176 
177 	if (copy_from_user(p, src, len)) {
178 		kfree(p);
179 		return ERR_PTR(-EFAULT);
180 	}
181 
182 	return p;
183 }
184 EXPORT_SYMBOL(memdup_user);
185 
186 /**
187  * vmemdup_user - duplicate memory region from user space
188  *
189  * @src: source address in user space
190  * @len: number of bytes to copy
191  *
192  * Return: an ERR_PTR() on failure.  Result may be not
193  * physically contiguous.  Use kvfree() to free.
194  */
vmemdup_user(const void __user * src,size_t len)195 void *vmemdup_user(const void __user *src, size_t len)
196 {
197 	void *p;
198 
199 	p = kvmalloc(len, GFP_USER);
200 	if (!p)
201 		return ERR_PTR(-ENOMEM);
202 
203 	if (copy_from_user(p, src, len)) {
204 		kvfree(p);
205 		return ERR_PTR(-EFAULT);
206 	}
207 
208 	return p;
209 }
210 EXPORT_SYMBOL(vmemdup_user);
211 
212 /**
213  * strndup_user - duplicate an existing string from user space
214  * @s: The string to duplicate
215  * @n: Maximum number of bytes to copy, including the trailing NUL.
216  *
217  * Return: newly allocated copy of @s or an ERR_PTR() in case of error
218  */
strndup_user(const char __user * s,long n)219 char *strndup_user(const char __user *s, long n)
220 {
221 	char *p;
222 	long length;
223 
224 	length = strnlen_user(s, n);
225 
226 	if (!length)
227 		return ERR_PTR(-EFAULT);
228 
229 	if (length > n)
230 		return ERR_PTR(-EINVAL);
231 
232 	p = memdup_user(s, length);
233 
234 	if (IS_ERR(p))
235 		return p;
236 
237 	p[length - 1] = '\0';
238 
239 	return p;
240 }
241 EXPORT_SYMBOL(strndup_user);
242 
243 /**
244  * memdup_user_nul - duplicate memory region from user space and NUL-terminate
245  *
246  * @src: source address in user space
247  * @len: number of bytes to copy
248  *
249  * Return: an ERR_PTR() on failure.
250  */
memdup_user_nul(const void __user * src,size_t len)251 void *memdup_user_nul(const void __user *src, size_t len)
252 {
253 	char *p;
254 
255 	/*
256 	 * Always use GFP_KERNEL, since copy_from_user() can sleep and
257 	 * cause pagefault, which makes it pointless to use GFP_NOFS
258 	 * or GFP_ATOMIC.
259 	 */
260 	p = kmalloc_track_caller(len + 1, GFP_KERNEL);
261 	if (!p)
262 		return ERR_PTR(-ENOMEM);
263 
264 	if (copy_from_user(p, src, len)) {
265 		kfree(p);
266 		return ERR_PTR(-EFAULT);
267 	}
268 	p[len] = '\0';
269 
270 	return p;
271 }
272 EXPORT_SYMBOL(memdup_user_nul);
273 
__vma_link_list(struct mm_struct * mm,struct vm_area_struct * vma,struct vm_area_struct * prev)274 void __vma_link_list(struct mm_struct *mm, struct vm_area_struct *vma,
275 		struct vm_area_struct *prev)
276 {
277 	struct vm_area_struct *next;
278 
279 	vma->vm_prev = prev;
280 	if (prev) {
281 		next = prev->vm_next;
282 		prev->vm_next = vma;
283 	} else {
284 		next = mm->mmap;
285 		mm->mmap = vma;
286 	}
287 	vma->vm_next = next;
288 	if (next)
289 		next->vm_prev = vma;
290 }
291 
__vma_unlink_list(struct mm_struct * mm,struct vm_area_struct * vma)292 void __vma_unlink_list(struct mm_struct *mm, struct vm_area_struct *vma)
293 {
294 	struct vm_area_struct *prev, *next;
295 
296 	next = vma->vm_next;
297 	prev = vma->vm_prev;
298 	if (prev)
299 		prev->vm_next = next;
300 	else
301 		mm->mmap = next;
302 	if (next)
303 		next->vm_prev = prev;
304 }
305 
306 /* Check if the vma is being used as a stack by this task */
vma_is_stack_for_current(struct vm_area_struct * vma)307 int vma_is_stack_for_current(struct vm_area_struct *vma)
308 {
309 	struct task_struct * __maybe_unused t = current;
310 
311 	return (vma->vm_start <= KSTK_ESP(t) && vma->vm_end >= KSTK_ESP(t));
312 }
313 
314 #ifndef STACK_RND_MASK
315 #define STACK_RND_MASK (0x7ff >> (PAGE_SHIFT - 12))     /* 8MB of VA */
316 #endif
317 
randomize_stack_top(unsigned long stack_top)318 unsigned long randomize_stack_top(unsigned long stack_top)
319 {
320 	unsigned long random_variable = 0;
321 
322 	if (current->flags & PF_RANDOMIZE) {
323 		random_variable = get_random_long();
324 		random_variable &= STACK_RND_MASK;
325 		random_variable <<= PAGE_SHIFT;
326 	}
327 #ifdef CONFIG_STACK_GROWSUP
328 	return PAGE_ALIGN(stack_top) + random_variable;
329 #else
330 	return PAGE_ALIGN(stack_top) - random_variable;
331 #endif
332 }
333 
334 #ifdef CONFIG_ARCH_WANT_DEFAULT_TOPDOWN_MMAP_LAYOUT
arch_randomize_brk(struct mm_struct * mm)335 unsigned long arch_randomize_brk(struct mm_struct *mm)
336 {
337 	/* Is the current task 32bit ? */
338 	if (!IS_ENABLED(CONFIG_64BIT) || is_compat_task())
339 		return randomize_page(mm->brk, SZ_32M);
340 
341 	return randomize_page(mm->brk, SZ_1G);
342 }
343 
arch_mmap_rnd(void)344 unsigned long arch_mmap_rnd(void)
345 {
346 	unsigned long rnd;
347 
348 #ifdef CONFIG_HAVE_ARCH_MMAP_RND_COMPAT_BITS
349 	if (is_compat_task())
350 		rnd = get_random_long() & ((1UL << mmap_rnd_compat_bits) - 1);
351 	else
352 #endif /* CONFIG_HAVE_ARCH_MMAP_RND_COMPAT_BITS */
353 		rnd = get_random_long() & ((1UL << mmap_rnd_bits) - 1);
354 
355 	return rnd << PAGE_SHIFT;
356 }
357 
mmap_is_legacy(struct rlimit * rlim_stack)358 static int mmap_is_legacy(struct rlimit *rlim_stack)
359 {
360 	if (current->personality & ADDR_COMPAT_LAYOUT)
361 		return 1;
362 
363 	if (rlim_stack->rlim_cur == RLIM_INFINITY)
364 		return 1;
365 
366 	return sysctl_legacy_va_layout;
367 }
368 
369 /*
370  * Leave enough space between the mmap area and the stack to honour ulimit in
371  * the face of randomisation.
372  */
373 #define MIN_GAP		(SZ_128M)
374 #define MAX_GAP		(STACK_TOP / 6 * 5)
375 
mmap_base(unsigned long rnd,struct rlimit * rlim_stack)376 static unsigned long mmap_base(unsigned long rnd, struct rlimit *rlim_stack)
377 {
378 	unsigned long gap = rlim_stack->rlim_cur;
379 	unsigned long pad = stack_guard_gap;
380 
381 	/* Account for stack randomization if necessary */
382 	if (current->flags & PF_RANDOMIZE)
383 		pad += (STACK_RND_MASK << PAGE_SHIFT);
384 
385 	/* Values close to RLIM_INFINITY can overflow. */
386 	if (gap + pad > gap)
387 		gap += pad;
388 
389 	if (gap < MIN_GAP)
390 		gap = MIN_GAP;
391 	else if (gap > MAX_GAP)
392 		gap = MAX_GAP;
393 
394 	return PAGE_ALIGN(STACK_TOP - gap - rnd);
395 }
396 
arch_pick_mmap_layout(struct mm_struct * mm,struct rlimit * rlim_stack)397 void arch_pick_mmap_layout(struct mm_struct *mm, struct rlimit *rlim_stack)
398 {
399 	unsigned long random_factor = 0UL;
400 
401 	if (current->flags & PF_RANDOMIZE)
402 		random_factor = arch_mmap_rnd();
403 
404 	if (mmap_is_legacy(rlim_stack)) {
405 		mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
406 		mm->get_unmapped_area = arch_get_unmapped_area;
407 	} else {
408 		mm->mmap_base = mmap_base(random_factor, rlim_stack);
409 		mm->get_unmapped_area = arch_get_unmapped_area_topdown;
410 	}
411 }
412 #elif defined(CONFIG_MMU) && !defined(HAVE_ARCH_PICK_MMAP_LAYOUT)
arch_pick_mmap_layout(struct mm_struct * mm,struct rlimit * rlim_stack)413 void arch_pick_mmap_layout(struct mm_struct *mm, struct rlimit *rlim_stack)
414 {
415 	mm->mmap_base = TASK_UNMAPPED_BASE;
416 	mm->get_unmapped_area = arch_get_unmapped_area;
417 }
418 #endif
419 
420 /**
421  * __account_locked_vm - account locked pages to an mm's locked_vm
422  * @mm:          mm to account against
423  * @pages:       number of pages to account
424  * @inc:         %true if @pages should be considered positive, %false if not
425  * @task:        task used to check RLIMIT_MEMLOCK
426  * @bypass_rlim: %true if checking RLIMIT_MEMLOCK should be skipped
427  *
428  * Assumes @task and @mm are valid (i.e. at least one reference on each), and
429  * that mmap_lock is held as writer.
430  *
431  * Return:
432  * * 0       on success
433  * * -ENOMEM if RLIMIT_MEMLOCK would be exceeded.
434  */
__account_locked_vm(struct mm_struct * mm,unsigned long pages,bool inc,struct task_struct * task,bool bypass_rlim)435 int __account_locked_vm(struct mm_struct *mm, unsigned long pages, bool inc,
436 			struct task_struct *task, bool bypass_rlim)
437 {
438 	unsigned long locked_vm, limit;
439 	int ret = 0;
440 
441 	mmap_assert_write_locked(mm);
442 
443 	locked_vm = mm->locked_vm;
444 	if (inc) {
445 		if (!bypass_rlim) {
446 			limit = task_rlimit(task, RLIMIT_MEMLOCK) >> PAGE_SHIFT;
447 			if (locked_vm + pages > limit)
448 				ret = -ENOMEM;
449 		}
450 		if (!ret)
451 			mm->locked_vm = locked_vm + pages;
452 	} else {
453 		WARN_ON_ONCE(pages > locked_vm);
454 		mm->locked_vm = locked_vm - pages;
455 	}
456 
457 	pr_debug("%s: [%d] caller %ps %c%lu %lu/%lu%s\n", __func__, task->pid,
458 		 (void *)_RET_IP_, (inc) ? '+' : '-', pages << PAGE_SHIFT,
459 		 locked_vm << PAGE_SHIFT, task_rlimit(task, RLIMIT_MEMLOCK),
460 		 ret ? " - exceeded" : "");
461 
462 	return ret;
463 }
464 EXPORT_SYMBOL_GPL(__account_locked_vm);
465 
466 /**
467  * account_locked_vm - account locked pages to an mm's locked_vm
468  * @mm:          mm to account against, may be NULL
469  * @pages:       number of pages to account
470  * @inc:         %true if @pages should be considered positive, %false if not
471  *
472  * Assumes a non-NULL @mm is valid (i.e. at least one reference on it).
473  *
474  * Return:
475  * * 0       on success, or if mm is NULL
476  * * -ENOMEM if RLIMIT_MEMLOCK would be exceeded.
477  */
account_locked_vm(struct mm_struct * mm,unsigned long pages,bool inc)478 int account_locked_vm(struct mm_struct *mm, unsigned long pages, bool inc)
479 {
480 	int ret;
481 
482 	if (pages == 0 || !mm)
483 		return 0;
484 
485 	mmap_write_lock(mm);
486 	ret = __account_locked_vm(mm, pages, inc, current,
487 				  capable(CAP_IPC_LOCK));
488 	mmap_write_unlock(mm);
489 
490 	return ret;
491 }
492 EXPORT_SYMBOL_GPL(account_locked_vm);
493 
vm_mmap_pgoff(struct file * file,unsigned long addr,unsigned long len,unsigned long prot,unsigned long flag,unsigned long pgoff)494 unsigned long vm_mmap_pgoff(struct file *file, unsigned long addr,
495 	unsigned long len, unsigned long prot,
496 	unsigned long flag, unsigned long pgoff)
497 {
498 	unsigned long ret;
499 	struct mm_struct *mm = current->mm;
500 	unsigned long populate;
501 	LIST_HEAD(uf);
502 
503 	ret = security_mmap_file(file, prot, flag);
504 	if (!ret) {
505 		if (mmap_write_lock_killable(mm))
506 			return -EINTR;
507 		ret = do_mmap(file, addr, len, prot, flag, pgoff, &populate,
508 			      &uf);
509 		mmap_write_unlock(mm);
510 		userfaultfd_unmap_complete(mm, &uf);
511 		if (populate)
512 			mm_populate(ret, populate);
513 	}
514 	return ret;
515 }
516 
vm_mmap(struct file * file,unsigned long addr,unsigned long len,unsigned long prot,unsigned long flag,unsigned long offset)517 unsigned long vm_mmap(struct file *file, unsigned long addr,
518 	unsigned long len, unsigned long prot,
519 	unsigned long flag, unsigned long offset)
520 {
521 	if (unlikely(offset + PAGE_ALIGN(len) < offset))
522 		return -EINVAL;
523 	if (unlikely(offset_in_page(offset)))
524 		return -EINVAL;
525 
526 	return vm_mmap_pgoff(file, addr, len, prot, flag, offset >> PAGE_SHIFT);
527 }
528 EXPORT_SYMBOL(vm_mmap);
529 
530 /**
531  * kvmalloc_node - attempt to allocate physically contiguous memory, but upon
532  * failure, fall back to non-contiguous (vmalloc) allocation.
533  * @size: size of the request.
534  * @flags: gfp mask for the allocation - must be compatible (superset) with GFP_KERNEL.
535  * @node: numa node to allocate from
536  *
537  * Uses kmalloc to get the memory but if the allocation fails then falls back
538  * to the vmalloc allocator. Use kvfree for freeing the memory.
539  *
540  * Reclaim modifiers - __GFP_NORETRY and __GFP_NOFAIL are not supported.
541  * __GFP_RETRY_MAYFAIL is supported, and it should be used only if kmalloc is
542  * preferable to the vmalloc fallback, due to visible performance drawbacks.
543  *
544  * Please note that any use of gfp flags outside of GFP_KERNEL is careful to not
545  * fall back to vmalloc.
546  *
547  * Return: pointer to the allocated memory of %NULL in case of failure
548  */
kvmalloc_node(size_t size,gfp_t flags,int node)549 void *kvmalloc_node(size_t size, gfp_t flags, int node)
550 {
551 	gfp_t kmalloc_flags = flags;
552 	void *ret;
553 
554 	/*
555 	 * vmalloc uses GFP_KERNEL for some internal allocations (e.g page tables)
556 	 * so the given set of flags has to be compatible.
557 	 */
558 	if ((flags & GFP_KERNEL) != GFP_KERNEL)
559 		return kmalloc_node(size, flags, node);
560 
561 	/*
562 	 * We want to attempt a large physically contiguous block first because
563 	 * it is less likely to fragment multiple larger blocks and therefore
564 	 * contribute to a long term fragmentation less than vmalloc fallback.
565 	 * However make sure that larger requests are not too disruptive - no
566 	 * OOM killer and no allocation failure warnings as we have a fallback.
567 	 */
568 	if (size > PAGE_SIZE) {
569 		kmalloc_flags |= __GFP_NOWARN;
570 
571 		if (!(kmalloc_flags & __GFP_RETRY_MAYFAIL))
572 			kmalloc_flags |= __GFP_NORETRY;
573 	}
574 
575 	ret = kmalloc_node(size, kmalloc_flags, node);
576 
577 	/*
578 	 * It doesn't really make sense to fallback to vmalloc for sub page
579 	 * requests
580 	 */
581 	if (ret || size <= PAGE_SIZE)
582 		return ret;
583 
584 	/* Don't even allow crazy sizes */
585 	if (WARN_ON_ONCE(size > INT_MAX))
586 		return NULL;
587 
588 	return __vmalloc_node(size, 1, flags, node,
589 			__builtin_return_address(0));
590 }
591 EXPORT_SYMBOL(kvmalloc_node);
592 
593 /**
594  * kvfree() - Free memory.
595  * @addr: Pointer to allocated memory.
596  *
597  * kvfree frees memory allocated by any of vmalloc(), kmalloc() or kvmalloc().
598  * It is slightly more efficient to use kfree() or vfree() if you are certain
599  * that you know which one to use.
600  *
601  * Context: Either preemptible task context or not-NMI interrupt.
602  */
kvfree(const void * addr)603 void kvfree(const void *addr)
604 {
605 	if (is_vmalloc_addr(addr))
606 		vfree(addr);
607 	else
608 		kfree(addr);
609 }
610 EXPORT_SYMBOL(kvfree);
611 
612 /**
613  * kvfree_sensitive - Free a data object containing sensitive information.
614  * @addr: address of the data object to be freed.
615  * @len: length of the data object.
616  *
617  * Use the special memzero_explicit() function to clear the content of a
618  * kvmalloc'ed object containing sensitive data to make sure that the
619  * compiler won't optimize out the data clearing.
620  */
kvfree_sensitive(const void * addr,size_t len)621 void kvfree_sensitive(const void *addr, size_t len)
622 {
623 	if (likely(!ZERO_OR_NULL_PTR(addr))) {
624 		memzero_explicit((void *)addr, len);
625 		kvfree(addr);
626 	}
627 }
628 EXPORT_SYMBOL(kvfree_sensitive);
629 
__page_rmapping(struct page * page)630 static inline void *__page_rmapping(struct page *page)
631 {
632 	unsigned long mapping;
633 
634 	mapping = (unsigned long)page->mapping;
635 	mapping &= ~PAGE_MAPPING_FLAGS;
636 
637 	return (void *)mapping;
638 }
639 
640 /* Neutral page->mapping pointer to address_space or anon_vma or other */
page_rmapping(struct page * page)641 void *page_rmapping(struct page *page)
642 {
643 	page = compound_head(page);
644 	return __page_rmapping(page);
645 }
646 
647 /*
648  * Return true if this page is mapped into pagetables.
649  * For compound page it returns true if any subpage of compound page is mapped.
650  */
page_mapped(struct page * page)651 bool page_mapped(struct page *page)
652 {
653 	int i;
654 
655 	if (likely(!PageCompound(page)))
656 		return atomic_read(&page->_mapcount) >= 0;
657 	page = compound_head(page);
658 	if (atomic_read(compound_mapcount_ptr(page)) >= 0)
659 		return true;
660 	if (PageHuge(page))
661 		return false;
662 	for (i = 0; i < compound_nr(page); i++) {
663 		if (atomic_read(&page[i]._mapcount) >= 0)
664 			return true;
665 	}
666 	return false;
667 }
668 EXPORT_SYMBOL(page_mapped);
669 
page_anon_vma(struct page * page)670 struct anon_vma *page_anon_vma(struct page *page)
671 {
672 	unsigned long mapping;
673 
674 	page = compound_head(page);
675 	mapping = (unsigned long)page->mapping;
676 	if ((mapping & PAGE_MAPPING_FLAGS) != PAGE_MAPPING_ANON)
677 		return NULL;
678 	return __page_rmapping(page);
679 }
680 
page_mapping(struct page * page)681 struct address_space *page_mapping(struct page *page)
682 {
683 	struct address_space *mapping;
684 
685 	page = compound_head(page);
686 
687 	/* This happens if someone calls flush_dcache_page on slab page */
688 	if (unlikely(PageSlab(page)))
689 		return NULL;
690 
691 	if (unlikely(PageSwapCache(page))) {
692 		swp_entry_t entry;
693 
694 		entry.val = page_private(page);
695 		return swap_address_space(entry);
696 	}
697 
698 	mapping = page->mapping;
699 	if ((unsigned long)mapping & PAGE_MAPPING_ANON)
700 		return NULL;
701 
702 	return (void *)((unsigned long)mapping & ~PAGE_MAPPING_FLAGS);
703 }
704 EXPORT_SYMBOL(page_mapping);
705 
706 /*
707  * For file cache pages, return the address_space, otherwise return NULL
708  */
page_mapping_file(struct page * page)709 struct address_space *page_mapping_file(struct page *page)
710 {
711 	if (unlikely(PageSwapCache(page)))
712 		return NULL;
713 	return page_mapping(page);
714 }
715 
716 /* Slow path of page_mapcount() for compound pages */
__page_mapcount(struct page * page)717 int __page_mapcount(struct page *page)
718 {
719 	int ret;
720 
721 	ret = atomic_read(&page->_mapcount) + 1;
722 	/*
723 	 * For file THP page->_mapcount contains total number of mapping
724 	 * of the page: no need to look into compound_mapcount.
725 	 */
726 	if (!PageAnon(page) && !PageHuge(page))
727 		return ret;
728 	page = compound_head(page);
729 	ret += atomic_read(compound_mapcount_ptr(page)) + 1;
730 	if (PageDoubleMap(page))
731 		ret--;
732 	return ret;
733 }
734 EXPORT_SYMBOL_GPL(__page_mapcount);
735 
736 int sysctl_overcommit_memory __read_mostly = OVERCOMMIT_GUESS;
737 int sysctl_overcommit_ratio __read_mostly = 50;
738 unsigned long sysctl_overcommit_kbytes __read_mostly;
739 int sysctl_max_map_count __read_mostly = DEFAULT_MAX_MAP_COUNT;
740 unsigned long sysctl_user_reserve_kbytes __read_mostly = 1UL << 17; /* 128MB */
741 unsigned long sysctl_admin_reserve_kbytes __read_mostly = 1UL << 13; /* 8MB */
742 
overcommit_ratio_handler(struct ctl_table * table,int write,void * buffer,size_t * lenp,loff_t * ppos)743 int overcommit_ratio_handler(struct ctl_table *table, int write, void *buffer,
744 		size_t *lenp, loff_t *ppos)
745 {
746 	int ret;
747 
748 	ret = proc_dointvec(table, write, buffer, lenp, ppos);
749 	if (ret == 0 && write)
750 		sysctl_overcommit_kbytes = 0;
751 	return ret;
752 }
753 
sync_overcommit_as(struct work_struct * dummy)754 static void sync_overcommit_as(struct work_struct *dummy)
755 {
756 	percpu_counter_sync(&vm_committed_as);
757 }
758 
overcommit_policy_handler(struct ctl_table * table,int write,void * buffer,size_t * lenp,loff_t * ppos)759 int overcommit_policy_handler(struct ctl_table *table, int write, void *buffer,
760 		size_t *lenp, loff_t *ppos)
761 {
762 	struct ctl_table t;
763 	int new_policy = -1;
764 	int ret;
765 
766 	/*
767 	 * The deviation of sync_overcommit_as could be big with loose policy
768 	 * like OVERCOMMIT_ALWAYS/OVERCOMMIT_GUESS. When changing policy to
769 	 * strict OVERCOMMIT_NEVER, we need to reduce the deviation to comply
770 	 * with the strict "NEVER", and to avoid possible race condtion (even
771 	 * though user usually won't too frequently do the switching to policy
772 	 * OVERCOMMIT_NEVER), the switch is done in the following order:
773 	 *	1. changing the batch
774 	 *	2. sync percpu count on each CPU
775 	 *	3. switch the policy
776 	 */
777 	if (write) {
778 		t = *table;
779 		t.data = &new_policy;
780 		ret = proc_dointvec_minmax(&t, write, buffer, lenp, ppos);
781 		if (ret || new_policy == -1)
782 			return ret;
783 
784 		mm_compute_batch(new_policy);
785 		if (new_policy == OVERCOMMIT_NEVER)
786 			schedule_on_each_cpu(sync_overcommit_as);
787 		sysctl_overcommit_memory = new_policy;
788 	} else {
789 		ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
790 	}
791 
792 	return ret;
793 }
794 
overcommit_kbytes_handler(struct ctl_table * table,int write,void * buffer,size_t * lenp,loff_t * ppos)795 int overcommit_kbytes_handler(struct ctl_table *table, int write, void *buffer,
796 		size_t *lenp, loff_t *ppos)
797 {
798 	int ret;
799 
800 	ret = proc_doulongvec_minmax(table, write, buffer, lenp, ppos);
801 	if (ret == 0 && write)
802 		sysctl_overcommit_ratio = 0;
803 	return ret;
804 }
805 
806 /*
807  * Committed memory limit enforced when OVERCOMMIT_NEVER policy is used
808  */
vm_commit_limit(void)809 unsigned long vm_commit_limit(void)
810 {
811 	unsigned long allowed;
812 
813 	if (sysctl_overcommit_kbytes)
814 		allowed = sysctl_overcommit_kbytes >> (PAGE_SHIFT - 10);
815 	else
816 		allowed = ((totalram_pages() - hugetlb_total_pages())
817 			   * sysctl_overcommit_ratio / 100);
818 	allowed += total_swap_pages;
819 
820 	return allowed;
821 }
822 
823 /*
824  * Make sure vm_committed_as in one cacheline and not cacheline shared with
825  * other variables. It can be updated by several CPUs frequently.
826  */
827 struct percpu_counter vm_committed_as ____cacheline_aligned_in_smp;
828 
829 /*
830  * The global memory commitment made in the system can be a metric
831  * that can be used to drive ballooning decisions when Linux is hosted
832  * as a guest. On Hyper-V, the host implements a policy engine for dynamically
833  * balancing memory across competing virtual machines that are hosted.
834  * Several metrics drive this policy engine including the guest reported
835  * memory commitment.
836  *
837  * The time cost of this is very low for small platforms, and for big
838  * platform like a 2S/36C/72T Skylake server, in worst case where
839  * vm_committed_as's spinlock is under severe contention, the time cost
840  * could be about 30~40 microseconds.
841  */
vm_memory_committed(void)842 unsigned long vm_memory_committed(void)
843 {
844 	return percpu_counter_sum_positive(&vm_committed_as);
845 }
846 EXPORT_SYMBOL_GPL(vm_memory_committed);
847 
848 /*
849  * Check that a process has enough memory to allocate a new virtual
850  * mapping. 0 means there is enough memory for the allocation to
851  * succeed and -ENOMEM implies there is not.
852  *
853  * We currently support three overcommit policies, which are set via the
854  * vm.overcommit_memory sysctl.  See Documentation/vm/overcommit-accounting.rst
855  *
856  * Strict overcommit modes added 2002 Feb 26 by Alan Cox.
857  * Additional code 2002 Jul 20 by Robert Love.
858  *
859  * cap_sys_admin is 1 if the process has admin privileges, 0 otherwise.
860  *
861  * Note this is a helper function intended to be used by LSMs which
862  * wish to use this logic.
863  */
__vm_enough_memory(struct mm_struct * mm,long pages,int cap_sys_admin)864 int __vm_enough_memory(struct mm_struct *mm, long pages, int cap_sys_admin)
865 {
866 	long allowed;
867 
868 	vm_acct_memory(pages);
869 
870 	/*
871 	 * Sometimes we want to use more memory than we have
872 	 */
873 	if (sysctl_overcommit_memory == OVERCOMMIT_ALWAYS)
874 		return 0;
875 
876 	if (sysctl_overcommit_memory == OVERCOMMIT_GUESS) {
877 		if (pages > totalram_pages() + total_swap_pages)
878 			goto error;
879 		return 0;
880 	}
881 
882 	allowed = vm_commit_limit();
883 	/*
884 	 * Reserve some for root
885 	 */
886 	if (!cap_sys_admin)
887 		allowed -= sysctl_admin_reserve_kbytes >> (PAGE_SHIFT - 10);
888 
889 	/*
890 	 * Don't let a single process grow so big a user can't recover
891 	 */
892 	if (mm) {
893 		long reserve = sysctl_user_reserve_kbytes >> (PAGE_SHIFT - 10);
894 
895 		allowed -= min_t(long, mm->total_vm / 32, reserve);
896 	}
897 
898 	if (percpu_counter_read_positive(&vm_committed_as) < allowed)
899 		return 0;
900 error:
901 	vm_unacct_memory(pages);
902 
903 	return -ENOMEM;
904 }
905 
906 /**
907  * get_cmdline() - copy the cmdline value to a buffer.
908  * @task:     the task whose cmdline value to copy.
909  * @buffer:   the buffer to copy to.
910  * @buflen:   the length of the buffer. Larger cmdline values are truncated
911  *            to this length.
912  *
913  * Return: the size of the cmdline field copied. Note that the copy does
914  * not guarantee an ending NULL byte.
915  */
get_cmdline(struct task_struct * task,char * buffer,int buflen)916 int get_cmdline(struct task_struct *task, char *buffer, int buflen)
917 {
918 	int res = 0;
919 	unsigned int len;
920 	struct mm_struct *mm = get_task_mm(task);
921 	unsigned long arg_start, arg_end, env_start, env_end;
922 	if (!mm)
923 		goto out;
924 	if (!mm->arg_end)
925 		goto out_mm;	/* Shh! No looking before we're done */
926 
927 	spin_lock(&mm->arg_lock);
928 	arg_start = mm->arg_start;
929 	arg_end = mm->arg_end;
930 	env_start = mm->env_start;
931 	env_end = mm->env_end;
932 	spin_unlock(&mm->arg_lock);
933 
934 	len = arg_end - arg_start;
935 
936 	if (len > buflen)
937 		len = buflen;
938 
939 	res = access_process_vm(task, arg_start, buffer, len, FOLL_FORCE);
940 
941 	/*
942 	 * If the nul at the end of args has been overwritten, then
943 	 * assume application is using setproctitle(3).
944 	 */
945 	if (res > 0 && buffer[res-1] != '\0' && len < buflen) {
946 		len = strnlen(buffer, res);
947 		if (len < res) {
948 			res = len;
949 		} else {
950 			len = env_end - env_start;
951 			if (len > buflen - res)
952 				len = buflen - res;
953 			res += access_process_vm(task, env_start,
954 						 buffer+res, len,
955 						 FOLL_FORCE);
956 			res = strnlen(buffer, res);
957 		}
958 	}
959 out_mm:
960 	mmput(mm);
961 out:
962 	return res;
963 }
964 
memcmp_pages(struct page * page1,struct page * page2)965 int __weak memcmp_pages(struct page *page1, struct page *page2)
966 {
967 	char *addr1, *addr2;
968 	int ret;
969 
970 	addr1 = kmap_atomic(page1);
971 	addr2 = kmap_atomic(page2);
972 	ret = memcmp(addr1, addr2, PAGE_SIZE);
973 	kunmap_atomic(addr2);
974 	kunmap_atomic(addr1);
975 	return ret;
976 }
977